CTI · reviewed · 2026-10-07

Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacks

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1110 Brute Force Credential Access
• T1078 Valid Accounts Stealth
• T1040 Network Sniffing Credential Access
• T1098 Account Manipulation Persistence
• T1070 Indicator Removal Stealth

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• 85.11.187.8 ipv4 · expired

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: FortiBleed FortigateSniffer Artifact File Creation
id: 9c5075c2-b1fd-4e20-9a40-e10854a1e3e0
status: experimental
description: >
    Detects creation of the named artifacts of the FortiBleed credential theft
    campaign: the Go-based FortigateSniffer capture output fg_capture.log and
    the Active Directory enumeration scripts ad_enum.py and ad_full_audit.py
    dropped after admin access is obtained on Fortinet edge devices, alongside
    Hashcat and Hashtopolis cracking orchestration. Filenames are documented
    by Recorded Future and SOCRadar reporting on the campaign.
references:
    - https://cyberscoop.com/fortibleed-fortinet-vpn-ransomware-fbi-warning/
    - https://www.bleepingcomputer.com/news/security/fortibleed-campaign-used-custom-fortigate-sniffer-to-steal-credentials/
    - https://unit42.paloaltonetworks.com/large-scale-credential-attacks/
    - https://blog.qualys.com/vulnerabilities-threat-research/2026/07/08/fortibleed-fortigate-credential-reuse-internet-exposed
author: Tia N. List
date: 2026-10-07
tags:
    - attack.t1040
    - attack.t1070
logsource:
    category: file_event
detection:
    selection_artifact:
        TargetFilename|contains:
            - 'fg_capture.log'
            - 'ad_enum.py'
            - 'ad_full_audit.py'
    condition: selection_artifact
falsepositives:
    - Administrator or incident-response tooling that legitimately uses these script names
    - Unrelated packet-capture files named fg_capture.log
level: high

References

• https://cyberscoop.com/fortibleed-fortinet-vpn-ransomware-fbi-warning/
• https://nvd.nist.gov/vuln/detail/CVE-2025-59718
• https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-sso-logins-following-disclosure-cve-2025-59718-cve-2025-59719/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59718
• https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24858
• https://nvd.nist.gov/vuln/detail/CVE-2026-24858
• https://www.hudsonrock.com/blog/fortibleed-75000-fortinet-firewalls-compromised-global-enterprises-exposed-claim-your-ethical-disclosure
• https://www.bleepingcomputer.com/news/security/cisa-warns-fortinet-users-to-secure-devices-after-fortibleed-leak/
• https://unit42.paloaltonetworks.com/large-scale-credential-attacks/